ed1099ff4725fa023eca100c236e53dba5c58c3221624b0431198500fb78e633

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 14:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-10_84dbfce06e3d545abc5439cb97930173_darkgate_elex_luca-stealer_mespinoza_njrat.exe
Size 13.0MB
Sample260910-rr3ftsyvhy
SHA256 ed1099ff4725fa023eca100c236e53dba5c58c3221624b0431198500fb78e633
MD5 84dbfce06e3d545abc5439cb97930173
SHA1 2f02dec48289dad63826fe8d71227106f87c8e7c
SHA512 3fc5e0b92998c94391eefa5a6ce68db89b17b293a186590ec0f882406db26a5414b377713cc023db15408038a668490eee581259304fa44bfb608d042c5b7c90
SSDEEP 393216:2lFyfLPHiRE5bxH6QaAu5SVDMTNSG/lVrl3KExL3JzATN:AUbxHPvQ6yhpKOxc
TLSH
T197D62305B792DCA5C8305B7C2068A313813A1D038F55AAEF5F967B5D4E78AF1C9B3632
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4556	QoIv1bPQz.exe

Contacts third-party web service commonly abused for C2 1 TTPs 1 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
5	pastebin.com

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1204	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-10_84dbfce06e3d545abc5439cb97930173_darkgate_elex_luca-stealer_mespinoza_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	QoIv1bPQz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4712 wrote to memory of 4556	4712	2026-09-10_84dbfce06e3d545abc5439cb97930173_darkgate_elex_luca-stealer_mespinoza_njrat.exe	86
PID 4712 wrote to memory of 1204	4712	2026-09-10_84dbfce06e3d545abc5439cb97930173_darkgate_elex_luca-stealer_mespinoza_njrat.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-09-10_84dbfce06e3d545abc5439cb97930173_darkgate_elex_luca-stealer_mespinoza_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-10_84dbfce06e3d545abc5439cb97930173_darkgate_elex_luca-stealer_mespinoza_njrat.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4712
- C:\Users\Admin\AppData\Local\Temp\QoIv1bPQz.exe
  "C:\Users\Admin\AppData\Local\Temp\QoIv1bPQz.exe" /i
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4556
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\del_.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1204

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

QoIv1bPQz.exe

Path C:\Users\Admin\AppData\Local\Temp\QoIv1bPQz.exe
Size 12.0MB
SHA256 9f3ed608db7514c791b7438af721d359e13411821b90793a8702cff56a57aefc
MD5 47231b41e00251749873875954d006d1
SHA1 0cd440b059637670a5f07c429ea94d2ae1052ced
SHA512 d8b1bbab500f2bd6c13ae7cb8ac651f338f0cb9b63f045328ecf089a1fbac5bbc788ec6c5a13861d08fef20eeef02fecedf8b09b4eadfadd8dec2bfe81ed05d9
SSDEEP 196608:2lF9gfXLaAeAi2KOld5bxazLlQCcHsJcQvQaT0u5SHvOYDMVByQyVG/uzGNq:2lFyfLPHiRE5bxavlQCcv6QaAu5SVDMg
TLSH
T189C62309B79299B4C8301B7C2024A313813E1E435F65AAEF5E967B5D4E78AF1C5B3633
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

del_.bat

Path C:\Users\Admin\AppData\Local\Temp\del_.bat
Size 337B
SHA256 05e795183bf74d54e5cfabba51d6c5f8fae02ed633197824fa7ccd1cd4fbe552
MD5 98fcb680e9f45247c821fc357d8a0cb5
SHA1 33169e080bfadaa7cb0d476fe10eeda332a426cd
SHA512 f3160fa908d401a07ee2983136b660b47cb74724462e5e40d9416cfd232f83597251fade255320873d8d91bc72d00517f0edd38f7cad518c8898aef4e446803f
TLSH
T195E0260B0425A6013009785F02F726CEE82968CB1B49FBC0A314492B78C650EAAF9B8D
MD5 SHA1 SHA512 TLSH